What's hard is producing a reasonable model. Once you have one, sampling from it is easy.

Agreed.

I expect the Vanguard simulator to be an exercise in marketing and so be trivially simple (pick a random historical return for S&P500, pick another random historical return from, say, some aggregate bond index, combine according to portfolio weights, repeat).

Clicking through the link, this is close to what they're doing (they appear to select the same year to preserve the asset class correlations):

For each year of each simulation, we randomly select one year of stock, bond, and stable-value returns from the database. Using those values, we calculate what would happen to your portfolio—subtracting your spending, adjusting for inflation, and adding your investment return. We repeat this process, one year at a time, until the end of your retirement or until your portfolio runs out of money. The next simulation starts the whole process from the beginning. After 5,000 independent simulations, we've tested a broad range of possible scenarios, and clear patterns begin to emerge.